TI-2026-79579 Aliases CVE-2026-4952 GHSA-636r-rhx8-pwmx

Stored XSS in VertiGIS WebOrderSystem (AuftragsManager) via Business Reference

LOW 23CWE-79Published 2026-10-23 · Updated 2026-10-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

VertiGIS WebOrderSystem (AuftragsManager) in the VertiGIS GIS Portal, version 7.0.8.6 is affected, and the vendor did not provide information about further affected versions. The business reference field in the ASMobile web interface does not neutralize JavaScript, which is a cross-site scripting weakness (CWE-79). An authenticated user with low privileges can store script in the business reference, and it runs in the OrderAdministration portal when a highly privileged user opens the order, with user interaction required.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XSS). However, the business reference is included in the order details when the user places an order through the web interface. The order is later listed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the stored code is executed as soon as a highly privileged user opens the order. Version 7.0.8.6 of WebOrderSystem, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00284 21st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VertiGIS Ltd.	WebOrderSystem (AuftragsManager)	up to 7.0.8.6	—	No fix listed	CNA

WebOrderSystem (AuftragsManager) VendorVertiGIS Ltd. Affected up to 7.0.8.6 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for VertiGIS WebOrderSystem (AuftragsManager).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-23 Threatist record created from CVE-2026-4952
2026-10-23 Alias added: GHSA-636r-rhx8-pwmx
2026-10-28 CISA SSVC decision points changed

References

Advisory 1

https://r.sec-consult.com/vertigis

TI-2026-00330 Local File Inclusion in the File Upload/Download Process CVSS 4.0HIGH 7.4
TI-2026-03356 Reflected Cross-Site Scripting in Dashboard Search CVSS 4.0HIGH 7.3
TI-2021-08867 VertiGIS WebOffice 10.7 SP1 before patch20210202 and 10.8 SP1 before patch20210207 allows… CVSS 3.1HIGH 7.5
TI-2026-79578 Reflected XSS in VertiGIS WebOrderSystem CustomerAdministration Portal CVSS 4.0MEDIUM 5.1
TI-2026-79577 Stored cross-site scripting in VertiGIS WebOrderSystem KundenManager CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences